76
CVEs
9
Critical
49
High
0
KEV
0
PoC
58
Unpatched C/H
5.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
49
MEDIUM
15
LOW
3
Monthly CVE Trend
Affected Products (30)
Teamcenter Visualization
143
Jt2Go
129
Debian Linux
91
Tecnomatix Plant Simulation
76
Telecontrol Server Basic
75
Simcenter Femap
67
Sinec Infrastructure Network Services
64
Fedora
58
Sinema Remote Connect Server
53
Scalance W1750D Firmware
51
Parasolid
50
Sinec Nms
42
Ubuntu Linux
36
Solid Edge Se2023
35
Sppa T3000 Ms3000 Migration Server
35
Solid Edge
34
Sinec Ins
33
Cloud Backup
33
Wincc
31
Clustered Data Ontap
30
Jt Utilities
29
Instant
28
Jt Open Toolkit
26
Arubaos
26
Node.js
26
Comos
25
Simatic Pcs7
25
Simatic Pcs Neo
24
Simatic Wincc
23
Splunk
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58115 | Unauthenticated remote code execution affects Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) gateways running Industrial OS with Node-RED installed, in all versions prior to V4.3.4.1. The Node-RED HTTP interface ships without authentication, exposing programming nodes that run system commands, so any attacker with network reachability can push malicious flows and execute code as the highest-privilege user. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 10.0 rating and trivial exploitation make this a top-priority patch for exposed devices. | CRITICAL | 10.0 | 0.7% | 61 |
No patch
|
| CVE-2026-25786 | Stored cross-site scripting in Siemens SIMATIC S7-1500 controller family web interface allows authenticated high-privilege attackers to inject malicious code via crafted PLC/station names in TIA project files. When users with appropriate rights later access the communication parameters page, injected scripts execute in their session context with high impact to confidentiality, integrity, and availability across system boundaries (CVSS 9.3, CVSS:4.0 S:H). No public exploit identified at time of analysis, but CVSS vector indicates low attack complexity (AC:L) once attacker gains privileged project upload access. | CRITICAL | 9.3 | 0.0% | 57 |
No patch
|
| CVE-2026-25787 | Stored cross-site scripting (XSS) in Siemens SIMATIC S7-1500 and ET 200SP controller families allows authenticated attackers with high privileges to inject malicious scripts via Technology Object (TO) names when downloading TIA Portal projects. The scripts execute when authorized users access the Motion Control Diagnostics web interface page, enabling session hijacking, credential theft, or privileged actions performed under the victim's context. This affects over 100 product variants across industrial automation controllers, software controllers, and open controllers. No active exploitation confirmed (not in CISA KEV). EPSS score not provided in dataset. CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability in both vulnerable and subsequent systems. | CRITICAL | 9.3 | 0.0% | 57 |
No patch
|
| CVE-2025-40949 | Command injection in Siemens RUGGEDCOM ROX industrial router series allows high-privileged authenticated remote attackers to execute arbitrary commands with root privileges on the underlying operating system. Affects all MX5000/MX5000RE/RX1400/RX1500/RX1501/RX1510/RX1511/RX1512/RX1524/RX1536/RX5000 models running firmware versions below V2.17.1. The vulnerability exists in the Scheduler functionality of the Web UI due to improper input sanitization (CWE-78). CVSS v4.0 score of 8.9 reflects high impact across confidentiality, integrity, and availability with network attack vector but requires high-privilege authentication. No public exploit identified at time of analysis, and EPSS data not available for this recently published CVE. | HIGH | 8.9 | 0.2% | 55 |
No patch
|
| CVE-2026-22924 | Remote unauthenticated attackers can exhaust resources and bypass authentication controls in Siemens SIMATIC CN 4100 versions before V5.0, enabling denial of service conditions and unauthorized actions that compromise system availability and integrity. The vulnerability stems from improper connection validation (CWE-306), allowing network-based exploitation without any user interaction or privileges. Siemens has released V5.0 to address this flaw, documented in security advisory SSA-032379. | HIGH | 8.8 | 0.0% | 54 |
No patch
|
| CVE-2026-69109 | Unauthenticated arbitrary file read in Siemens License Server (SLS) versions prior to V5.3 allows remote attackers to traverse the filesystem and access sensitive files without any credentials. The root cause is missing sanitization of user-supplied path input (CWE-35), and the CVSS 4.0 score of 8.7 reflects network-exploitable access with no authentication or user interaction required and high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack complexity is low and the attack surface is any network-reachable SLS instance. | HIGH | 8.7 | 0.5% | 54 |
No patch
|
| CVE-2026-46746 | Authenticated command injection in Siemens SINEC INS versions prior to V1.0 SP2 Update 6 allows remote attackers to execute arbitrary OS commands as the sinecins service account by submitting crafted directory names to the /api/sftp/uploadFiles endpoint. The injected payloads are stored and triggered later when directory listings are retrieved, producing a stored/second-order command injection. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.7 reflects high impact across confidentiality, integrity, and availability of the underlying host. | HIGH | 8.7 | 0.2% | 54 |
No patch
|
| CVE-2026-46748 | Local privilege escalation in Siemens SINEC INS (versions prior to V1.0 SP2 Update 6) stems from a binary shipped with the Linux cap_dac_override capability, which bypasses filesystem discretionary access control checks. An authenticated local attacker can leverage this overly broad capability to read or modify any file on the system, ultimately obtaining root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.7 | 0.0% | 54 |
No patch
|
| CVE-2025-40833 | Denial of service in Siemens industrial networking equipment allows remote unauthenticated attackers to crash affected devices via specially crafted IPv4 packets, requiring manual restart for recovery. This vulnerability affects over 200 Siemens industrial automation products including SCALANCE switches/routers, SIMATIC PLCs, SINAMICS drives, and RUGGEDCOM devices. CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network-accessible attack vector requiring low complexity and no privileges (AV:N/AC:L/PR:N). No public exploit code or CISA KEV listing identified at time of analysis, though the straightforward network-based attack and widespread product exposure warrant priority patching for operational technology environments where uptime is critical. | HIGH | 8.7 | 0.0% | 54 |
No patch
|
| CVE-2026-22925 | Siemens SIMATIC CN 4100 versions prior to V5.0 can be rendered unavailable through TCP SYN flood attacks, allowing remote unauthenticated attackers to exhaust system resources and cause complete service disruption. The CVSS 4.0 score of 8.7 reflects the high availability impact (VA:H) combined with network-accessible attack vector requiring no privileges or user interaction. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though SYN flood techniques are well-documented and trivial to execute. | HIGH | 8.7 | 0.0% | 54 |
No patch
|
| CVE-2026-27664 | Out-of-bounds write vulnerabilities in Siemens CPCI85 Central Processing/Communication and SICORE Base system (versions below V26.10) allow unauthenticated remote attackers to crash critical industrial control system services through maliciously crafted XML requests, resulting in denial-of-service conditions. CISA's SSVC framework marks this as automatable with partial technical impact, though no public exploit has been identified at time of analysis. The CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with network accessibility requiring no authentication (PR:N). | HIGH | 8.7 | 0.0% | 54 |
No patch
|
| CVE-2026-33893 | Hardcoded cryptographic keys in Siemens Teamcenter PLM software enable remote attackers to bypass authentication and gain unauthorized access to confidential product lifecycle management data. The vulnerability affects multiple Teamcenter versions (V2312, V2406, V2412, V2506, V2512) and is remotely exploitable without authentication (CVSS:4.0 AV:N/AC:L/PR:N). While no active exploitation or public POC has been identified at time of analysis, the straightforward nature of hardcoded credential extraction (AC:L) combined with the criticality of Teamcenter as an enterprise PLM platform housing intellectual property makes this a high-priority remediation target for manufacturing and engineering organizations. | HIGH | 8.7 | 0.0% | 54 |
No patch
|
| CVE-2026-33862 | Stored cross-site scripting (XSS) in Siemens Teamcenter allows authenticated attackers with low privileges to inject malicious JavaScript that executes in other users' browser sessions, enabling session hijacking, credential theft, or unauthorized actions within the product lifecycle management platform. Affects Teamcenter versions V2312 through V2512 with vendor patches released for all branches. CVSS v4.0 scores 8.5 (High) due to network attack vector with low complexity, though exploitation requires user interaction and authenticated access. No public exploit code or CISA KEV listing identified at time of analysis. | HIGH | 8.5 | 0.0% | 53 |
No patch
|
| CVE-2026-69108 | Local privilege escalation in Siemens License Server (SLS) versions prior to V5.1 allows a local attacker with elevated operating system privileges to execute arbitrary commands and write malicious files as root, resulting in full system compromise. The root cause is an insecure sudoers policy (CWE-732) that grants overly permissive command execution rights, enabling abuse of sudo rules to break out of intended privilege boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-integrity and high-confidentiality impact on the vulnerable system underscores urgency for organizations running SLS in multi-user or shared infrastructure environments. | HIGH | 8.3 | 0.1% | 52 |
No patch
|
| CVE-2026-24349 | Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 8.2 | 0.0% | 51 |
No patch
|